docs(webhook): clarify header authentication in SDK examples

README.md

@@ -685,6 +685,15 @@ The SDK provides commands for ingesting events into Flowcore event types.
 
 > **Important**: Ingestion operations require API key authentication.
 
+Create an API-key client before running either ingestion command. The SDK sends the raw key in the `Authorization` header and keeps it out of the webhook URL. Load the key from a secret store; do not put it in a query string.
+
+```typescript
+const client = new FlowcoreClient({
+  apiKeyId: process.env.FLOWCORE_API_KEY_ID!,
+  apiKey: process.env.FLOWCORE_API_KEY!,
+})
+```
+
 #### Ingest a Single Event
 
 ```typescript

test/fixtures/fetch.fixture.ts

@@ -8,6 +8,7 @@ interface MockedRequest {
   path: string
   headers: Record<string, string> | null
   searchParams: Record<string, string | string[]> | null
+  noSearchParams: boolean
   body: string | Record<string, unknown> | Array<unknown> | null
   status: number
   response: string | Record<string, unknown> | Array<unknown> | null
@@ -160,6 +161,10 @@ export class FetchMockBuilder {
         }
       }
 
+      if (mockedRequest.noSearchParams && Object.keys(searchParams).length > 0) {
+        return false
+      }
+
       if (mockedRequest.headers) {
         try {
           assertObjectMatch(mockedRequest.headers, headers)
@@ -213,6 +218,7 @@ class FetchMockBuilderPath {
   private path: string
   private headers: Record<string, string> | null = null
   private searchParams: Record<string, string | string[]> | null = null
+  private noSearchParams = false
   private body: string | Record<string, unknown> | Array<unknown> | null = null
   private status = 200
   private response: string | Record<string, unknown> | Array<unknown> | null = null
@@ -230,6 +236,11 @@ class FetchMockBuilderPath {
     return this
   }
 
+  public withoutSearchParams() {
+    this.noSearchParams = true
+    return this
+  }
+
   public matchBody(body: string | Record<string, unknown> | Array<unknown>) {
     this.body = body
     return this
@@ -261,6 +272,7 @@ class FetchMockBuilderPath {
       path: this.path,
       headers: this.headers,
       searchParams: this.searchParams,
+      noSearchParams: this.noSearchParams,
       body: this.body,
       status: this.status,
       response: this.response,

test/tests/commands/ingestion.test.ts

@@ -30,6 +30,7 @@ describe("Ingestion", () => {
       const fetchMockerBuilder = fetchMocker.mock(mockWebhookUrl)
 
       fetchMockerBuilder.post(`/event/${tenantName}/${dataCoreId}/${flowTypeName}/${eventTypeName}`)
+        .withoutSearchParams()
         .matchBody(eventData)
         .matchHeaders({
           "Content-Type": "application/json",
@@ -233,6 +234,7 @@ describe("Ingestion", () => {
       const fetchMockerBuilder = fetchMocker.mock(mockWebhookUrl)
 
       fetchMockerBuilder.post(`/events/${tenantName}/${dataCoreId}/${flowTypeName}/${eventTypeName}`)
+        .withoutSearchParams()
         .matchBody(events)
         .matchHeaders({
           "Content-Type": "application/json",